What is the CVSS score of CVE-2026-14156?

CVE-2026-14156 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14156?

Yes, a patch is available for CVE-2026-14156. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14156

EUVD-2026-40843 MEDIUM

Improper Access Control (CWE-284)

2026-06-30 chrome-cve-admin@google.com

GHSA-pjx6-5gp7-gmg5

Authentication Bypass Google Red Hat

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

5.3 MEDIUM

Renderer pre-compromise is a non-trivial chained prerequisite that warrants AC:H over the vendor's AC:L; all other metrics align with the description.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.8 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:50 vuln.today

CVE Published

Jun 30, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Same-origin policy bypass in Google Chrome's StorageAccessAPI allows an attacker who has already compromised the Chrome renderer process to further escalate access via a crafted HTML page, affecting all Chrome versions prior to 150.0.7871.47. The integrity impact is rated High (I:H) in the CVSS vector, meaning cross-origin data writes or manipulations become possible, but only as a second-stage component in a chained exploit. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and SSVC rates exploitation as none with partial technical impact - consistent with the renderer pre-compromise prerequisite that substantially limits standalone risk.

Technical ContextAI

The StorageAccess API is a W3C browser feature permitting embedded cross-site iframes to programmatically request access to first-party storage, bridging isolated storage partitions for legitimate federated identity use cases. CWE-284 (Improper Access Control) identifies the root cause as Chrome's policy enforcement logic for this API failing to correctly restrict cross-origin access when invoked from a renderer context that has already been compromised. The same-origin policy (SOP) is a foundational browser isolation boundary; bypassing it allows one origin to read or write data belonging to another origin. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome stable releases up to but not including 150.0.7871.47 as confirmed by the EUVD entry EUVD-2026-40843. The SUSE tag suggests downstream Chromium-based packages in SUSE Linux distributions are also in scope.

RemediationAI

Upgrade Google Chrome to version 150.0.7871.47 or later; this is the vendor-released patch per the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. SUSE users should apply corresponding SUSE security updates for their Chromium packages as they become available from the SUSE advisory channel. Because exploitation requires a prior renderer compromise, organizations should also ensure Chrome's Site Isolation (--site-per-process) and sandbox features are enforced via enterprise policy, as these reduce the blast radius of renderer-level compromises - disabling them for compatibility reasons substantially increases exposure to chained attacks of this type. No documented workarounds exist for the StorageAccessAPI policy bypass itself absent the patch.